🔄 Dependency Audit & Security Update Analysis

[ahelme]

🔍 Stale Dependencies Analysis & Security Review

Current Situation

During AsyncAPI implementation, we discovered several deprecated dependencies in validation toolchain:

Deprecated Packages:

• @apidevtools/swagger-cli@4.0.4 → Abandoned, recommends @redocly/cli
• Multiple deprecated sub-dependencies with security vulnerabilities
• 19 total vulnerabilities (14 moderate, 2 high, 3 critical)

Impact Assessment Required

Before updating dependencies, we need to analyze:

✅ What's Working (DO NOT BREAK):

• AsyncAPI 3.0.0 contract validation
• OpenAPI 3.0.3 contract validation
• GitHub workflow protocol validation
• Documentation server functionality
• Chrome extension integration

🔍 Analysis Needed:

1. Dependency mapping - Which tools are actually used vs. installed
2. Alternative evaluation - @redocly/cli vs @apidevtools/swagger-cli
3. Security impact - Are vulnerabilities exploitable in our use case?
4. Breaking changes - Will updates affect validation commands/output?
5. Testing strategy - How to validate replacements work identically

Proposed Investigation Steps

Phase 1: Current State Analysis

• Document exact validation commands currently working
• Test current tools against our contracts (baseline)
• Map vulnerability impact (are they in unused code paths?)

Phase 2: Alternative Research

• Evaluate @redocly/cli compatibility with our OpenAPI contract
• Test AsyncAPI CLI latest version compatibility
• Document command syntax differences

Phase 3: Safe Migration Strategy

• Create test branch for dependency updates
• Update GitHub workflow to test both old/new tools
• Validate identical output for contract validation

Success Criteria

• Zero breaking changes to existing AsyncAPI/OpenAPI validation
• GitHub workflow continues passing
• Security vulnerabilities resolved
• Documentation updated with new commands

Priority

Medium - System is working, but security updates should be addressed systematically

Related

• Connected to AsyncAPI implementation (PR 🔌 Complete AsyncAPI WebSocket Protocol Documentation System #60)
• GitHub workflow: .github/workflows/protocol-validation.yml
• Root validation: package.json dependencies

Note: This is separate from the working AsyncAPI system. Do not rush updates that could break existing functionality.